# Deserialization of Untrusted Data in Telerik Reporting Report Designers (CVE-2026-106140)

## Description

October 2026 - [CVE-2026-106140](https://www.cve.org/CVERecord?id=CVE-2026-106140)

* Progress® Telerik® Reporting .NET Framework report designers (Standalone Report Designer and Visual Studio Report Designer), versions `>= 0` and `< 20.3.26.1110`.
* The .NET 8+ report designer is not affected.

### What Are the Impacts

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

## Issue

* CWE-502: Deserialization of Untrusted Data
* CAPEC-586: Object Injection

## Solution

The issue is fixed in version 20.3.26.1110. The Progress Telerik team strongly recommends upgrading to this version or later.

| Current Version             | Update to         |
| --------------------------- | ----------------- |
| `>= 0` and `< 20.3.26.1110` | `>= 20.3.26.1110` |

**Behavior changes:**

* Report items copied with an earlier version of the designer cannot be pasted into the updated designer.
* Visual Studio-specific content, such as project types and event handlers, is not carried over when you copy and paste between separate Visual Studio instances.

Follow the [update instructions](https://www.telerik.com/products/reporting/documentation/upgrade/overview) for precise instructions. All customers who have a license for Progress® Telerik® Reporting can access their downloads here: [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.

## External References

[CVE-2026-106140](https://www.cve.org/CVERecord?id=CVE-2026-106140) (High)

**CVSS:** 7.3

**Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local user with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.